ShinyHunters is exploiting an Oracle PeopleSoft vulnerability at scale again, and this time the group has found a way around the web application firewall rules many operators relied on for protection, according to Mandiant and Google Threat Intelligence Group. The renewed campaign targets CVE-2026-35273, the same flaw the group used as a zero-day in June, and now reaches victims outside academia as well, covering higher education, technology, IT services, healthcare, agriculture, transportation, and government.
The bypass is a single character. According to the analysis, the threat actor URL-encoded one character in the request path, asking for /%50SEMHUB/ instead of /PSEMHUB/, so string-matching WAF and reverse proxy rules miss the request while the PeopleSoft application server decodes it and routes it to the vulnerable Environment Management Hub endpoint. That means organizations whose firewall rules blocked the literal path may have believed they were covered when they were not.
Read more: Unit 42 Says Pass-ta-key Attacks Can Bypass Google Password Manager Passkeys
Mandiant says the group, tracked as UNC6240, has deployed web shells on dozens of systems around the world in this wave. The expansion matters because the June activity was aimed predominantly at academic institutions, while the current targeting crosses several industries.
The firm's quick guide tells administrators to switch off the PeopleSoft Environment Management Hub service in multi-server deployments, or delete the PSEMHUB application altogether on a single server, and to comb through WebLogic access logs for percent-encoded versions of the path.
The renewed exploitation follows the June 2026 report on ShinyHunters targeting the education sector through the same Oracle PeopleSoft exploit. In that earlier campaign, the vulnerability was used as a zero-day, mostly against academic institutions, before the group modified its tooling to evade the firewall rules put in place afterward.
Oracle has also faced criticism on an unrelated front. Earlier this year, Oracle employees received termination emails as the company filed roughly 3,126 H-1B petitions across fiscal years 2025 and 2026, including 436 in 2026 alone, a contrast that drew employee backlash. That dispute centered on staffing decisions, not product security.
What the advisory leaves open is how many PeopleSoft installations remain exposed behind WAF rules that match the literal path. Mandiant's first listed action is applying Oracle's patch for CVE-2026-35273, released in an out of band alert on June 10, and it cautions that perimeter path blocking is no replacement for that fix.
For defenders, the practical takeaway is that a firewall rule matching /PSEMHUB/ is not the same as blocking the endpoint. Until the vulnerable servlet is patched or otherwise protected, requests that decode to the same path can still reach it.
